Linux kernel VFIO drivers/vfio/pci/vfio_pci_intrs.c - MSI/MSI-X allocation: Sibling of CVE-2016-9083 in the same

Impact

Sibling of CVE-2016-9083 in the same MSI/MSI-X setup path - the kzalloc size computation overflows, the kernel allocates a buffer far smaller than the interrupt array it is about to populate, and the heap is corrupted. Same reachability, same consequence: the process holding a tenant's passed-through GPU corrupts host kernel memory. Catalogued separately because the two were fixed in one commit and an operator checking only one CVE ID against a vendor changelog can convince themselves they are patched when they are not.

Who can reach it

Local process with access to a VFIO PCI device file - the tenant's VMM or a container granted /dev/vfio.

What to do

Same fix as CVE-2016-9083 (commit 05692d7005a364add85c6e25a6c4447ce08f913a, RHSA-2017:0386); one kernel upgrade and rolling reboot closes both. Verify by kernel version rather than by CVE ID in a vendor advisory list, since backport changelogs frequently name only one of the pair.

References